1
1
Граф коммитов

3712 Коммитов

Автор SHA1 Сообщение Дата
Jon Simons
7aa496d844 pkd: remove blowfish-cbc cipher passes
Support for the `blowfish-cbc` cipher has been removed from OpenSSH
as of version 7.6.  Remove this cipher from the pkd tests so that
the tests will pass together with a modern OpenSSH client.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 19:42:51 -07:00
Jon Simons
bf10a66b5d pkd: emit error message for OpenSSH clients < 7.0
Emit a friendly error message for OpenSSH clients older than
7.0.  Some of the recent pkd changes now require a modern
client to support some newer config options.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 19:42:43 -07:00
Jon Simons
adc817cf13 pkd: specify PubkeyAcceptedTypes for OpenSSH client
As of OpenSSH 6.9, support for `ssh-dss` user keys is disabled by default
at runtime.  Specify an explicit `-o PubkeyAcceptedKeyTYpes` in the pkd
tests to explicitly enable each user key type being tested, including
`ssh-dss`.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 19:42:37 -07:00
Jon Simons
787a649390 pkd: specify HostKeyAlgorithms for OpenSSH client
As of OpenSSH 6.9, support for `ssh-dss` host keys is disabled by default
at runtime.  Specify an explicit `-o HostKeyAlgorithms` in the pkd tests
to explicitly enable each host key type being tested, including `ssh-dss`.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 19:42:33 -07:00
Jon Simons
54690e6cdd pkd: run with SOCKET_WRAPPER_LIBRARY
Use the socket_wrapper preload shim when running the `pkd_hello`
test with `make test`.  The end goal here is to get this test
running alongside normal tests in regular CI.  Changes to do
this:

 * Configure PKD_ENVIRONMENT for the `pkd_hello_i1` test in the
   CMakeLists.txt file.

 * Add a `--socket-wrapper-dir|-w` flag that is used to opt-in to
   initializing a SOCKET_WRAPPER_DIR as expected by the socket_wrapper
   library.

   A runtime flag is used here to make it easy to run `pkd_hello`
   with the socket_wrapper library while avoiding a hard dependency.

Testing done: observed socker_wrapper in effect with `strace`;
running `make test` uses the wrapper correctly on my local
machine.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 19:41:10 -07:00
Jon Simons
4e3fb81172 pkd: add_test pkd_hello_i1 for make test
Add an entry for a `pkd_hello_i1` test which runs one iteration
through each of the pkd algorithm combinations.

Testing done: now `make test` will run `pkd_hello -i1` which
completes in ~25 seconds on my local machine.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 19:41:02 -07:00
Jon Simons
6273c409e3 pkd: fix missing config.h #include
Ensure to include config.h so that the `HAVE_DSA` value is properly set
when building the pkd tests.

Introduced with 778652460f,

Testing done: with this change, the `pkd_hello` test is passing on an
OpenSSL 1.1.0 build for me.  Previously it would fail pubkey exchange
early on for DSA- and ECDSA-type host keys.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:25:36 +02:00
Jon Simons
7798d39187 dh: fix two leaks in ssh_get_pubkey_hash
Fix two memory leaks in `ssh_get_pubkey_hash` for some error paths.
The local `h` buffer and `ctx` MD5 context each must be free'd for
the SSH_ERROR cases.

Introduced with 16217454d5.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:25:34 +02:00
Jon Simons
58ef1e96b8 dh: fix ssh_get_pubkey_hash indentation
Fix `ssh_get_pubkey_hash` indentation to use softabs
with 4 spaces.  No change in behavior.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:25:32 +02:00
Jon Simons
732818ebb2 tests: fix -Wunused-function warning in torture_pki_ecdsa.c
Wrap some function definitions with `HAVE_LIBCRYPTO` ifdefs to
match their usages in `torture_run_tests`.

Fixes this warning I observe when building locally:

    torture_pki_ecdsa.c:341:13: warning:
         ‘torture_pki_ecdsa_write_privkey’ defined but not used
         [-Wunused-function]

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:25:30 +02:00
Jon Simons
448de134ac ecdh: fix SSH_MSG_KEXDH_REPLY for mbedTLS
Ensure to provide the `ssh_string` pubkey blob to the buffer packing
routine when computing the SSH_MSG_KEXDH_REPLY message, rather than
the new `ssh_key` type.

Introduced with 16217454d5.

Testing done: with this change, the `pkd_hello` test is passing on a
mbedTLS build for me.  Previously it would segfault during pubkey
exchange with "ecdh-sha2-nistp256".

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:25:28 +02:00
Jon Simons
fd3d8d6496 ecdh: fix SSH_MSG_KEXDH_REPLY for libgcrypt
Ensure to provide the `ssh_string` pubkey blob to the buffer packing
routine when computing the SSH_MSG_KEXDH_REPLY message, rather than
the new `ssh_key` type.

Introduced with 16217454d5.

Testing done: with this change, the `pkd_hello` test is passing on a
libgcrypt build for me.  Previously it would segfault during pubkey
exchange with "ecdh-sha2-nistp256".

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:25:26 +02:00
Jon Simons
0b90ab102e ecdh: fix SSH_MSG_KEXDH_REPLY for libcrypto
Ensure to provide the `ssh_string` pubkey blob to the buffer packing
routine when computing the SSH_MSG_KEXDH_REPLY message, rather than
the new `ssh_key` type.

Introduced with 16217454d5.

Testing done: with this change, `pkd_hello` test is passing on an
OpenSSL 1.1.0 build for me.  Previously it would segfault during
pubkey exchange with "ecdh-sha2-nistp256".

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:25:24 +02:00
Anderson Toshiyuki Sasaki
cd3170fcb1 gitlab: Use wine to run tests built for Windows
When building in a cross-compiling environment, use wine to run the
tests.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:23:12 +02:00
Anderson Toshiyuki Sasaki
9eaf55898e cmake: Added executable exension on test binaries
This is necessary when building the tests for Windows.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 21:20:26 +02:00
Andreas Schneider
10e1e396fc gitlab: Add build with mbedtls
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 12:01:54 +02:00
Andreas Schneider
c1db283c39 gitlab: Enable build with libgcrypt
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 12:01:51 +02:00
Andreas Schneider
6c97122120 torture: Don't exclude filter mechanism on Windows
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 10:51:45 +02:00
Andreas Schneider
0dd33d8ed1 torture: Don't include sys/socket.h on Windows
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 10:44:31 +02:00
Andreas Schneider
0db12d7f75 gitlab: Don't error out if obj exists
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 10:16:45 +02:00
Anderson Toshiyuki Sasaki
c1d8ba47dd gitlab: Added builds for Windows using MinGW
Only the unit tests are run.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 09:45:35 +02:00
Andreas Schneider
dc4cc08c3a gitlab: Use obj dir for building
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 09:45:35 +02:00
Andreas Schneider
e880cafed0 tests: Call ssh_session_is_known_server()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 09:45:35 +02:00
Andreas Schneider
1ae014f52a dh: Fix reference to ssh_session_update_known_hosts()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 09:45:35 +02:00
Andreas Schneider
1369559385 include: Fix reference to ssh_session_update_known_hosts
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 09:45:35 +02:00
Andreas Schneider
7ef72ec91f doc: Updated guided tour for knownhosts changes
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 09:45:35 +02:00
Andreas Schneider
b74a184172 torture: Fix building on Windows
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-27 09:45:35 +02:00
Alberto Aguirre
b50fb638f7 knownhosts: Fix windows build failure
Signed-off-by: Alberto Aguirre <albaguirre@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-25 08:20:40 +02:00
Andreas Schneider
e06ae8e096 include: Declare ge25519_base as extern
Thanks to Tilo Eckart.

The global variable "ge25519_base" is referenced in the module
"src/external/ed25519.c" and initialized in "src/external/ge25519.c".
The lack of the extern keyword in the header results in different
instances being compiled into both translation units with some
compilers.

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-21 17:41:32 +02:00
Andreas Schneider
0940b0f29b knownhosts: Do not double free memory
CID 1393236

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-06 08:38:14 +02:00
Andreas Schneider
03b05c8a5e tests: Add missing newline to KNOWN_HOST_ENTRY_ED25519
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-05 14:42:21 +02:00
Andreas Schneider
9e4f9a26d4 tests: Allow knownhosts verify test to validate ed25519 and ecdsa
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-05 10:50:59 +02:00
Andreas Schneider
f5f8c0fc76 knownhosts: Fix resource leak in ssh_known_hosts_parse_line()
CID 1391444

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-05 10:44:54 +02:00
Andreas Schneider
c4dbe3b863 knownhosts: Fix a memory leak on error
CID 1391446

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-05 10:43:08 +02:00
Andreas Schneider
669678119c knownhosts: Fix possible null pointer dereference
CID 1391447

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-05 10:35:42 +02:00
Andreas Schneider
34e7a3cf8c knownhosts: Fix resource leak in ssh_session_update_known_hosts()
CID 1391448

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-05 10:34:56 +02:00
Andreas Schneider
1001cbbb99 knownhosts: Fix resource leak in ssh_known_hosts_read_entries()
CID 1391449

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-05 10:34:49 +02:00
Aris Adamantiadis
36d52ee205 buffer: Add ssh_buffer_allocate() function
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 16:55:23 +02:00
Aris Adamantiadis
0ad462102a packet: Add more debugging
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 16:55:21 +02:00
Aris Adamantiadis
c6ee41bff3 cmake: add WITH_PACKET_DEBUG option
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 16:55:18 +02:00
Andreas Schneider
5012a9c146 examples: Use new known hosts functions
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
93781f9d5a libsshpp: Use new known hosts functions
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
4550c99222 known_hosts: Mark ssh_is_server_known as deprecated
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
a209f928d2 kwonhosts: Add functions to check if servers public key is known
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
f23dbe6f42 knownhosts: Add ssh_session_update_known_hosts()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
974e1831a0 knownhosts: Add ssh_session_export_known_hosts_entry()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
963c46e4fb knownhosts: Add ssh_session_has_known_hosts_entry()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
32c49ea134 misc: Add ssh_list_count()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
a465ea2d49 knownhosts: Add ssh_known_hosts_read_entries()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00
Andreas Schneider
702e9e8ad5 knownhosts: Introduce new known hosts managing functions
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-04 11:20:28 +02:00